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Amendments to the Claims : 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

Listing of Claims : 

1. (canceled) 

2. (currently amended) The method of claim 20 wherein the processing step comprises 

defining a first traffic class corresponding to the web service; 
defining at least a second traffic class corresponding to an attribute of the web 
service; and 

associating the at least a second traffic class as a child traffic class of the first 
traffic class in a hierarchical traffic classification scheme. 

3. (original) The method of claim 2 wherein the attribute in the second defining step is 
an operation of the web service. 

4. (original) The method of claim 2 wherein the attribute in the second defining step is 
a binding supported by the web service. 

5. (previously presented) The method of claim 20 wherein the web services interface 
definition document is a WSDL document. 

6. (currently amended) A method facilitating the classification of web services network 
traffic, comprising 

monitoring a data communications path for data flows associated with web 
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services network transactions corresponding to one or more web services; 

discovering, at a network device, one or more web services based on web service 

invocation messages received at the network device; 

maintaining a tracking list data structure comprising, for each discovered web 
service detected in the data flows , a web service identifier corresponding to the web 
service and a transaction count associated with the web service; 

incrementing, responsive to a message indicating a new web services network 
transaction, a transaction count associated with the web service identified in the 
message; 

presenting, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one 
or more web service identifiers; and 

configuring, responsive to selection of a web service identifier, a network traffic 
classification mechanism to identify the web service corresponding to the web service 
identifier by creating a traffic class identifier corresponding to the web service; creating 
at least one matching rule defining an attribute of the web service; associating the at 
least one matching rule to the traffic class identifier in the traffic classification 
mechanism. 

7. (canceled) 

8. (original) The method of claim 7 wherein the attribute in the second creating step is 
the web service identifier corresponding to the web service. 

9. (original) The method of claim 8 further comprising 

creating at least one additional matching rule defining an attribute of the web 
service. 
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10. (original) The method of claim 9 wherein the attribute in the third creating step is a 
protocol associated with the web service. 

11. (original) The method of claim 10 wherein the protocol is a web services protocol. 

12. (original) The method of claim 10 wherein the protocol is the SOAP protocol. 

13. (original) The method of claim 10 wherein the protocol is the HTTP protocol. 

14. (original) The method of claim 6 further comprising 

maintaining a count of the number of data flows corresponding to each web 
service traversing the communications path. 

15. (original) The method of claim 6 wherein the web service identifier comprises a 
host name. 

16. (original) The method of claim 6 wherein the web service identifier comprises a 
host name and a uniform resource indicator. 

17. (original) The method of claim 6 wherein the configuring step is performed in 
response to a command from an end user. 

18. (original) The method of claim 6 wherein the monitoring step comprises 

upon detection of a new data flow, 

parsing at least one packet in the data flow to identify the protocol 
attributes corresponding to the data flow; 
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matching the identified protocol attributes to a predetermined set of web 
services protocol attributes to determine whether the data flow is web services web 
services data flow. 

19. (original) The method of claim 18 wherein the parsing step comprises parsing the at 
least one packet in the data flow into a flow specification, wherein the flow specification 
contains at least one instance of any one of the following: a protocol family designation, 
a direction of packet flow designation, a protocol type designation, a binding type, a 
pair of hosts, a pair of ports, a pointer to a MIME type, a pointer to an application- 
specific attribute. 

20. (currently amended) A method facilitating the claooification of web ocrvicco 
network traffic, comprioing The method of claim 6 wherein the configuring the network 
traffic classification mechanism further comprises 

receiving an interface definition document defining the attributes of the web 
service; 

processing the interface definition document to identify at least one traffic class 
corresponding to the web service; and 

configuring a network traffic classification mechanism to identify the at least one 
traffic class based on at least one attribute obtained from the web services definition 
document. 

21. (original) The method of claim 20 further comprising 

subsequent to the configuring step, processing the latest interface definition 
document corresponding to the web service to determine whether changes to the 
configuration of the network traffic classification mechanism are required. 
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22. (currently amended) An apparatus facilitating the classification of web services 
network traffic, comprising 

a packet processor operative to 

detect data flows in network traffic traversing a network; 
a traffic classification database operative to 

match data flows against a plurality of traffic classes, wherein each traffic 
class in the plurality of traffic classes is defined by at least one matching attribute; 
a web services classification module operative to 

identify web services in the data flows traversing the network; 

discover one or more web services based on web service invocation 
messages received at the packet processor; 

maintain a tracking data structure comprising, for each discovered w eb 
service detected in the data flowo , a web service identifier corresponding to the web 
service and a count of the number of web services network transactions detected in the 
data flows traversing the network; 

increment, responsive to a message indicating a new web services 
network transaction, a transaction count associated with the web service identified in 
the message; 

present, in a user interface, one or more of the web service identifiers and 
corresponding transaction counts, wherein the user interface allows for selection of one 
or more web service identifiers; and 

create, responsive to selection of a web service identifier, a traffic class in 
the traffic classification database for a selected web service in the data structure, 
wherein at least one matching rule associated with the traffic class includes the web 
service identifier associated with the web service. 



23. (original) The apparatus of claim 22 wherein the web services classification module 
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is further operative to 

receive an interface definition document defining the attributes of the selected 
web service; 

process the interface definition document to identify at least one traffic class 
corresponding to the selected web service; and 

create the at least one traffic class in the traffic classification database, wherein at 
least one matching rule associated with the corresponding traffic class is based on one 
or more attributes in the interface definition document. 

24. (original) The apparatus of claim 23 wherein the at least one traffic class is 
identified relative to the operations identified in the interface definition document. 

25. (original) The apparatus of claim 23 wherein the at least one traffic class is 
identified relative to the bindings identified in the interface definition document. 

26. -30. (canceled) 

31. (previously presented) The apparatus of claim 23 wherein, to process the interface 
definition document, the web services classification module is further operative to 

define a first traffic class corresponding to the web service; 
define at least a second traffic class corresponding to an attribute of the 
web service; and 

associate the at least a second traffic class as a child traffic class of the first 
traffic class in a hierarchical traffic classification scheme. 

32. (previously presented) The apparatus of claim 31 wherein the attribute in the 
second defining step is an operation of the web service. 
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33. (previously presented) The apparatus of claim 31 wherein the attribute in the 
second defining step is a binding supported by the web service. 

34. (previously presented) The method of claim 6 wherein the tracking list data 
structure comprises a hash table including one or more entries, wherein each entry 
comprises a key value and a transaction count, wherein the key value is generated by 
applying a hashing function to a host name and URI pair identified in messages 
initiating web services network transactions. 

35. (previously presented) The method of claim 6 further comprising applying one or 
more bandwidth utilization controls to data flows based on the web services traffic 
classes associated with the data flows by the traffic classification mechanism. 

36. (previously presented) The apparatus of claim 22 wherein the tracking data 
structure comprises a hash table including one or more entries, wherein each entry 
comprises a key value and a transaction count, wherein the key value is generated by 
applying a hashing function to a host name and URI pair identified in messages 
initiating web services network transactions. 
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